Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Which log rotation tool do you prefer?

share|improve this question
add comment

4 Answers

up vote 10 down vote accepted

In my experience, logrotate is great. It's very flexible, and works well with most software.

However, there are some issues with it, and as cronolog is primarily a web log rotation facility, I'll write down my experience with logrotate + apache which was problematic:

When rotating logs , we must notify apache that a log is being rotated, as even if logrotate renames access.log to access.log.1, apache will continue writing to access.log.1, as it is writing to the inode, and renaming the file doesn't affect the inode number.

On debian etch (and probably many other distros), logrotate is being used to rotate apache logs. Now, apache has a graceful restart that advises the apache child processes to exit once they finish serving existing connections, apache then re-reads it's configuration, spawns new child processes, which start writing to a new log file (In case the previous one was rotated).

This sounds like a great solution, however graceful restart does not always work in certain conditions (like heavy load), so debian developers decided to use an apache restart instead of a graceful restart, in the apache logrotate configuration. Unfortunetly this causes all connections to be dropped at once, which is very bad for heavily loaded sites. In addition, apache restart can also cause problems like apache stopping and not starting (also in certain load situations), see bug links below for details.

The bottom line is, logrotate is great, but can lead to certain issues for certain programs. I don't have much experience with cronolog, but as it writes logs through a pipe, it doesn't require any apache reloads when it's rotating log files, which basically solves all that is described above.

Related logrotate/apache debian bugs:

  1. Debian bug #301702
  2. Debian bug #400455
share|improve this answer
1  
the solution for the above is to use truncate ! what it does is to copy the contents of access.log to access.log.1 and then empty the access.log (as you see the inode remains of access_log remains the same). Usually you don't have logs larger than a few GB (in worst caase), so the whole process won't take a long time ! –  Nikolaidis Fotis Mar 6 '11 at 22:14
add comment

I prefer cronolog, but it isn't a really strong preference.

logrotate where is started by cron, and if a system is down for some reason when the rotate should have happened, then your log files won't be rotated.

I also like having log files have the date (%Y%m.combined.access.log) in the name because I keep those logs around for a long time. On most systems, by default, apache logrotate will name the files access.log,access.log.1,etc. It may be possible to use a date in the logfiles with logrotate, but I couldn't figure out how to do last time I looked.

share|improve this answer
2  
The issue where logrotate doesn't work if it's passed the cron time can be fixed by installing the "anacron" package. –  andrewd18 Jun 5 '09 at 13:03
    
or even better you can save your logs in the desired format -this can be done with templates in rsyslog - (%year%-%month%-%day%_lala.log) . in this case, you don't even have to rotate the logs, because every day tha name is changed ! –  Nikolaidis Fotis Mar 6 '11 at 22:17
add comment

Only ever used logrotate. It's what Debian uses by default and I've never had any complaints with it.

share|improve this answer
add comment

I almost exclusively use cronolog over logrotate. Logrotate comes with Debian, and I allow it to keep working for the system services like the mail server logs. But for apache and lighttpd log files, it's all cronolog.

One of of the reasons why I use cronolog is that all the configuration happens in the log-file line of the web server config

e.g. in a lighttpd config file, you could put :

accesslog.filename = "|/usr/bin/cronolog --symlink="/var/log/webs/access.log /var/log/webs/%Y/%W-access.log"

And all get a a new log file every week without any other configuration. Or you could get creative and do something like :

accesslog.filename = "|/usr/bin/cronolog --symlink="/var/log/webs/access.log /var/log/webs/%Y/%m/%a-access.log"

And get a log file that shows traffic by day of the week. I.E. all Sundays, all Tuesdays.

What's better is that even if the server is down for any amount of time, the correct log file will be used upon restart

share|improve this answer
1  
That looks a lot like svlogd (of runit and daemontools lineage). –  Tobu Mar 6 '11 at 21:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.